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Abstract 



O 
O 

In this paper, we propose a method of enciphering quantum states of two-state 
systems (qubits) for sending them in secrecy without entangled qubits shared by 
two legitimate users (Alice and Bob). This method has the following two properties. 
First, even if an eavesdropper (Eve) steals qubits, she can extract information from 
them with certain probability at most. Second, Alice and Bob can confirm that the 
qubits are transmitted between them correctly by measuring a signature. If Eve 
measures m qubits one by one from n enciphered qubits and sends alternative ones 
(the Intercept/Resend attack), a probability that Alice and Bob do not notice Eve's 
action is equal to (3/4) m or less. Passwords for decryption and the signature are 
given by classical binary strings and they are disclosed through a public channel. 
Enciphering classical information by this method is equivalent to the one-time pad 
method with distributing a classical key (random binary string) by the BB84 proto- 
col. If Eve takes away qubits, Alice and Bob lose the original quantum information. 
If we apply our method to a state in iteration, Eve's success probability decreases 
exponentially. We cannot examine security against the case that Eve makes an 
attack with using entanglement. This remains to be solved in the future. 



1 Introduction 

Since considerable progress was made in quantum information and computation theory, 
many researchers have been studying to realize the information processing that we have 
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never had by using quantum mechanics ]T6|]. At the same time, it has been studying 
to apply the uncertainty principle, the quantum no-cloning theorem, and entanglement 
between quantum systems to cryptography^. The BB84 protocol is considered to be 
an effective method for the key distribution. By combining it with the one-time pad 
method, we obtain a highly secure cryptography[^]0|§]. On the other hand, the quantum 
teleportation is considered to be an excellent method for sending arbitrary quantum states 
between two parties 

The BB84 protocol is used for a secure distribution of a classical key (binary string) 
to two legitimate users (Alice and Bob). Choosing a basis vector at random from four 
basis vectors, the rectilinear basis {|0), |1)} and the circular basis {(l/v2)(|0) ± |1))}, as 
a state of a photon (a two-state system or a qubit), Alice sends it to Bob. Bob measures 
a transmitted photon in an orthonormal basis that he chooses from two bases (rectilinear 
and circular) at random and independently of Alice. 

Not being consistent with each other, the rectilinear basis and the circular basis are 
called conjugate bases. A result of measurement with a wrong basis is random. If an 
eavesdropper (Eve) steals a photon from the channel, measures it in a basis chosen at 
random, and sends an alternative one, Alice and Bob find inconsistency with probability 
of 1/4 or more and notice Eve's eavesdropping. In this way, by using the uncertainty 
principle, the BB84 protocol reveals Eve's illegal act. 

A. K. Ekert proposed another protocol for distributing a classical key by transmitting 
pairs of qubits in EPR states, \^~) = (l/v / 2)(|01) — 1 10} ) , apart to Alice and Bob from 
a source||. They detect Eve by Bell's theorem. Considering a simplified protocol of 
A. K. Ekert's, C. H. Bennett et al. showed it was equivalent to BB84j4|. From these 
successive works, it has been recognized that we do not need to use the entanglement 
for distributing a classical key by quantum mechanics. (But, by combining entangle- 
ment purification protocol with Ekert's protocol, we can distribute a classical key in high 
secrecy 0.) 

The quantum teleportation is used for transmitting an arbitrary state from Alice 
to Bob. They share an EPR-pair of qubits beforehand. Alice carries out the Bell- 
measurement on both a one-qubit state that she wants to send and her qubit of 
the EPR-pair. Receiving a result of her measurement, Bob can construct from his 
qubit of the EPR-pair. A characteristic of this method is that classical information and 
non-classical information of are divided perfectly and only the classical information 
is sent through the public channel. If they share the EPR-pair correctly, Eve can neither 
eavesdrop on the state nor destroy it in principle. 

These methods are related to the quantum no-cloning theorem. It tells us there is no 
unitary transformation that makes accurate clones of arbitrary quantum states||. In the 
BB84 protocol, it gives an effect as follows. Not knowing which basis is chosen for a qubit 
(photon) that she extracts from the quantum channel, rectilinear or circular, Eve cannot 
make a clone of the qubit and keep it. What she can do is only measuring the qubit in a 
proper basis and sending an alternative one that depends on a result of the measurement 
to Bob. In the quantum teleportation, the following thing is important. Because Alice 
can neither measure without disturbance nor make an accurate clone of it, she cannot 
extract information from at all. During the whole process, Alice and Bob have no 
knowledge about \ip). 
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In the quantum teleportation, Alice and Bob have to share an EPR-pair of qubits 
beforehand. After being emitted by a source, this pair flies towards them apart through 
a quantum channel. Therefore, for example, if Eve takes away the qubit that Bob is 
supposed to have and sends an alternative one to him, she succeeds in eavesdropping. 
To avoid such a trouble, Alice and Bob need to share a lot of EPR-pairs and to purify 
them fl . 

In this paper, we consider a method for enciphering arbitrary quantum states for 
sending them in secrecy without entangled qubits shared by Alice and Bob beforehand. 
In our method, there are two points as follows. (See Figure [|) 

First, even if Eve takes away qubits, she can extract quantum information from them 
with certain probability at most. (If Eve measures m qubits one by one from n enciphered 
qubits and sends alternative ones, a probability that Alice and Bob do not notice Eve's 
act is equal to (3/4) m or less. We assume Eve makes only the Intercept /Resend attack^.) 
Alice applies a unitary operator C/j which is chosen at random from a set of operators 
M. = {Uj} to an arbitrary n-qubit state |\&) that she wants to send in secrecy. The 
subscript % of TJ\ is a password for decryption. Not knowing which operator is chosen from 
A4, Eve regards the enciphered state as a mixed state of Uj\^f) for all Uj G M. with equal 
probability. If Alice prepares M. so that the density operator of the mixed state may be 
in proportion to the identity operator I, Eve cannot extract the information of at all 
without the password i. The reason of this is that even if Eve puts auxiliary qubits on 
the density operator p = (l/2 n )I, applies unitary transformations to it, or measures it, 
she cannot extract After confirming that the quantum state is transmitted correctly, 
Alice releases the password i in our protocol. Therefore, to extract information from 
1^), Eve has to eavesdrop without disturbing Alice and Bob's certification process. (This 
technique has been also discussed by P. O. Boykin and V. Roychowdhury, and M. Mosca 
et al. ||17|| . They have shown the following result. When we define Ai as a set of tensor 



products of the Pauli matrices, the number of the operators {U{} gets minimum and the 
subscript i is represented by a 2n-bit string.) 

Second, Alice and Bob can confirm that a quantum state received by Bob is a genuine 
one sent by Alice. Not having knowledge about the n-qubit state \^)q at all, they 
do not notice Eve replace the genuine qubits with alternative ones. Therefore, they 
need to confirm that the qubits Bob receives are genuine. (It seems like authentication 
of the identity of a correspondent on networks.) In our method, after putting an n- 
qubit state \a)s {a G {0,1}") that represents her signature on U®\^)q, Alice makes 
entanglement between qubits of each pair in the system Q and S. Here, we call the 
quantum system which represents the transmitted information Q and the quantum system 
which represents the signature S. Then, to forbid Eve to make clones of qubits, Alice 
applies an operator chosen at random from C = {I, H,a x , Ha x } to each qubit, where 
H is called the Hadamard transformation and it causes |0) — > ( 1 / v^2) ( 1 0) + |1)), |1) — > 
(l/v / 2)(|0) — |1)), and a x is one of the Pauli matrices and it causes |0) — > |1), |1) — > |0). 
Hence, quantum information of each qubit is encoded in a basis chosen at random from 
two conjugate bases (rectilinear and circular). Therefore, if Eve does anything on the 
qubits, Alice and Bob can find inconsistency and detect Eve with certain probability. 
This is essentially the same technique used in BB84. In our method, certification of a 
correspondent and detection of Eve are done at the same time. The second password for 
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decryption is which operators are chosen from C. 

Because the passwords and the signature represented by classical binary strings are 
transmitted by the public channel, Eve also knows them. If \^f)q represents classical 
information (a product state of |0) and |1)), our protocol is equivalent to the one-time 
pad method with classical key distribution by BB84. 

If Alice and Bob apply our enciphering method to a state in iteration, a probability 
that Eve gets quantum information with fidelity of 1 decreases exponentially. (If they 
encipher a one-qubit state with N qubits, the probability is given by (3/4) 7V / 2 .) We can 
regard it as privacy amplification process. We cannot examine security against the case 
that Eve makes an attack with using entanglement. This remains to be solved in the 
future. 

This paper is organized as follows. In Sec. |2|, we explain how Alice and Bob forbid 
Eve to extract the original quantum information and how they confirm the qubits are 
transmitted correctly. In Sec. we explain the whole protocol and discuss how Bob 
confirms that he receives qubits. In Sec. §, we discuss security of our protocol against 
Eve's Intercept /Resend attack on each qubit. In Sec. we discuss privacy amplification 
process. In Sec. ||, we give a brief discussion. 

2 Enciphering quantum states 

In this section, we explain how Alice and Bob forbid Eve to extract the original quantum 
information and how they confirm the qubits are transmitted correctly. 

First, we consider transforming an arbitrary quantum state so that Eve cannot recover 
an original quantum state. For simplicity, we consider an arbitrary one-qubit state for 
a while and we describe its density operator as p defined on a two-dimensional Hilbert 
space Ti.2- We assume Alice wants to send p to Bob in secrecy. She does not know p at 
all, because her partial measurement destroys it. 

Alice prepares a set of operators, 

M = i a j '■ 3 = ^x,y,z}, 
where a = I (the identity operator) and {a x ,a y ,cr z } are the Pauli matrices. Taking 

io>-(;), id-(;). 

for an orthonormal basis, we write them as 

1 = ( o i ) ' Gx = ( i o ) ' ° y = ( < o* ) ' *' = ( o -i ) " 

Ai may be disclosed in public. Choosing an operator cr^ from Ai at random, Alice carries 
out the following unitary transformation, 
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She keeps the subscript i secret as a password and never tells it to anyone. Because the 
subscript takes a value from {0, x, y, z}, the password can be represented by 2-bit classical 
information. 

Not knowing which transformation Alice applies to the qubit, Eve has to regard the 
state as 

P = I E Git"]- 

j=0,x,y,z 

Generally, the density operator p satisfies pt = p, Trp = 1,0<Ai<1,0<A2<1, and 
Ai + A 2 = 1 where Ai, A2 are eigenvalues of p. Hence, we can describe an arbitrary p as 

P = 7^ + « •<>■), 

where a = (ai, 02, a 3 ) is a three-component real vector and < J2t=i a t — 1- Because 

1 1 

p'=o I+ o E o,-a j( ra}, (1) 

Z 6 j=0,x,y,z 

and 

(7 CT O- = { ° k 3 = ° T 3 = k 

3 k 3 \ -cr k j ± k and j, k G {x, y, z] ' 
there is no contribution from the second term of Eq. (jl]). We obtain 

H 2 

Therefore, even if Eve takes away p', she cannot extract information from it at all, because 
she does not know the password i. 

An arbitrary n-qubit density operator p n is given by 

^ = 4( /+ E a M), (2) 

fee{0,a;,y,z}™,fc^(0,-,0) 

where 

£4 = ® • • • ® 

and afc (fe G {0, x, y, z} n , k 7^ (0, •••,0)) is real. (In Eq. fl2|), 7 represents the identity 
operator for n-qubit states.) Choosing an operator Ui from 

M n = {U k : U k = <r kl ® • • • <g> cx fcn ,fc G {0,x,y,z} n }, 

at random, Alice applies it to p n for encryption as p n — > Uip n Uj. If Eve takes away the 
density operator given by 



P'n = Tn E 



4 r 

ie{0,a:, 1 /,z}" 

— J + — V a k U d U k U\ 

On An On ^ K 3 K 3 

j,k£{0,x,y,zy\k^(0,-,0) 

1 



Figure 1: The second encryption by Alice. 



|x k> Q | I0>, ll>, 7=0O>± H» 

L k,2 S 

la k>S-©^- IO>."l>.y=("0>±ll» 



x k , a k e {0, 1} 

L kil Q,L ki2 SG{7, H, o x ,Ha x } 



she cannot extract information from p' n at all. Even if she puts auxiliary systems on 
p' n , applies unitary transformations to it, or carries out measurements, she cannot obtain 
p n . The password of i is given by a 2n-bit string. (This technique is also discussed by 
P. O. Boykin and V. Roychowdhury, and M. Mosca et al. as mentioned in Sec. p]||17|.) 

Next, we explain how Alice and Bob confirm that the qubits are transmitted between 
them correctly. If Eve takes away p' n and sends an alternative state p n to Bob, he carries 
out the inverse operation on the state that he receives as p n — > Uip n U\. Not having 
knowledge about the original p n at all, Alice and Bob do not notice what Bob gets is a 
fake. 

To avoid this trouble, they put a signature on p n . Reading it, they can confirm that 
Bob receives the state transmitted from Alice correctly. It is important that Eve cannot 
change the signature. For simplicity, we describe the state as a ket vector V|\I/)q G H% 
instead of the density operator p n for a while. If the n-qubit state is given by a mixed 
state, we can give a similar discussion. We call the system that represents the quantum 
information Q and the system that represents the signature S. 

Preparing an n-bit random string Va = ( Oi, • • • , CL n ) G {0, l} n as her signature, Alice 
attaches a qubit \ak)s to the kth qubit of 



(4) 



£C£{0,1}" 



Applying the controlled-NOT (C-NOT) gate to the fcth pair as Figure [TJ, she obtains 



\xk)Q\ak)s -> W)qW © %k mod 2) s 



for k 



n. 



Choosing L^ 1; Lf 2 G C = {I,H,a x ,Ha x } at random, she applies them to the qubits of 
the pair, where 

Alice repeats this operation on the k = 1, - ■ ■ , nth qubit, and we write the whole transfor- 
mation as V® s . ex represents which operators are chosen from C The second password 
cx is given by a classical 4n-bit string. 
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Figure 2: Typical quantum gates, 
(i) controoled-NOT gate (ii) G x gate 



li> a 



\i>„ 



li> (J) liei (mod2)> 



'>b li©j (mod2)> b 



i,j € {0, 1} 



We often describe successive operations on qubits as a network like Figure |T]. A 
horizontal line represents a qubit and time proceeds from left to right. Figure |2| shows 
examples of unitary transformations applied to qubits. Figure 0. i and ii. represent the 



C-NOT gate and a x each[10 



The operations that we have discussed are summarized as follows, 

l*>Q ->• u ?\^)q ( lst password i) 

— > \a)s®Uf\$)Q (signature a) 

v S S W a )s ® U?\^)q] (2nd password a). 

Double encryption prevents Eve from using \a)s ill. If V^ 5 is not applied to the state, 
Eve may take away all of the qubits, keep Uf \^)q, and send a fake of |a)g® \^)q to Bob. 

If Eve does anything on the kth qubit of Q, the signature of \a k ) s is destroyed and Bob 
fails in the certification process with certain probability or more. This is caused by the 
facts that conjugate bases chosen at random represent the systems Q and S, and there is 
entanglement between Q and S. If she does anything on the kth qubit of S, we can get 
a similar result. We estimate a probability that Alice and Bob notice Eve's illegal act in 
Sec. |. 



3 The protocol for secure transmission 

We consider a protocol for transmitting an arbitrary quantum state V| G Ti^ from 
Alice to Bob in secrecy against Eve's eavesdropping by using the encryption method 
discussed in the previous section. Alice and Bob do not have knowledge about \$)q at 
all. Both of them can use the following two channels. 

• The classical channel: It transmits classical binary strings in public. Eve can make 
accurate copies of them, but she cannot alter them. 

• The quantum channel: It transmits sequences of qubits (quantum information). Eve 
can interact with them, but she cannot make accurate copies of them. 

Alice sends qubits to Bob according to the following protocol. (See Figure |3|.) 
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Figure 3: Secure transmission between Alice and Bob. 



classical channel 



Alice 



Bob 



quantum channel 
l^crypt>=Va QS [l«>S®U i Q|^> Q ] 



Figure 4: Eve's strategy for eavesdropping, 
classical channel 



Alice 



Bob 



1 1 crypr 



quantum channel 



=V a QS[ia> s (8,u i QlV> Q ] 



Eve 



V a QS[la> s ®|^> Q ] 



1. Alice sends l^erypt) = Va S [\ a ) s<&U®\^)q] of 2n qubits to Bob through the quantum 
channel. 

2. Receiving In qubits, Bob breaks off the quantum channel and reports arrival of 
them to Alice through the classical channel. 

3. Receiving the report from Bob, Alice tells Bob what transformation V® is through 
the classical channel. (She discloses the 4n-bit password a.) 

4. Applying V® s ^ to the state that he has received and measuring the signature, Bob 
tells Alice a result of the measurement (an n-bit string) through the classical channel. 

5. Receiving the n-bit string from Bob, Alice examines whether it coincides with the 
signature a or not. If it coincides with her original signature, she tells Bob what 
transformation Jjf is through the classical channel. (She discloses the 2n-bit pass- 
word i.) If it does not coincide, she concludes Eve has eavesdropped on qubits and 
stops the protocol. 

6. Bob applies Uf to the state that he has and obtains the original state \^)q- 

In this protocol, it is important that Bob confirms the arrival of 2n qubits decrypt) or 
Eve's fake) and breaks off the quantum channel at the second step. To understand the 
reason of this, we assume the following case. (See Figure f|.) Although \^ C r y pt) is still 
halfway on the channel, Bob reports the arrival of qubits to Alice by mistake, and she 
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discloses V® s through the classical channel. Eve may take away |^/ C r yp t), apply V^ 5 ^ to 
it, and obtain \a) s <g> Ui\^/)Q before Bob receives qubits. Eve can keep Ui\^f)Q, combine a 
false state \^)q with \a) s , and send V® s [\a) s £g> \^)q] to Bob. If the quantum channel is 
still open, Bob receives V® s [\a)s® \^)q]- Because the signature is correct, Alice and Bob 
cannot notice Eve's illegal act. Alice discloses Jjf in public and finally Eve gets \^>)q- 

To avoid this trouble, Bob needs to verify that a batch of qubits decrypt) or Eve's 
fake) has arrived. For example, it is good for Bob to take the following method. 

We construct a qubit from a pair of optical paths (modes) that are represented by x 
and y in Figure |5|. iii||ll||. We describe a state that there is no photon on a mode as |0) 



and a state that there is a photon on a mode as |1). Writing a state that no photon is 
on the mode x and one photon is on the mode y as lO)^ ® \ l) y = |01), we regard |01) as 
logical |0). We regard |l)j;|0)y as logical |1) similarly. Hence, we can write an arbitrary 
state of a qubit as 

= a|01) + P\10) = a\0) + for \a\ 2 + \(3\ 2 = 1. 

We assume Eve puts a 50-50 beamsplitter halfway on the quantum channel to take 
away photons. A state of a photon is a superposition of a state that it is on the side of 
Bob and a state that it is on the side of Eve with amplitude l/y/2 each, 

— ^=|photon on the side of Bob) H — ^|photon on the side of Eve), 
v 2 v 2 

To examine whether the qubit of \ip) has come on his own side or not, Bob prepares 
another auxiliary photon and applies nonlinear interaction between the logical photon 
on the mode x or y and the auxiliary one. On an optical system of Figure |[ iii, if the 
photon counter D a detects the auxiliary photon, the logical photon is projected into the 
state that it is on the side of Bob. On the other hand, Db's detection projects the logical 
photon into the state that it is on the side of Eve. 

In Figure |5]. iii, there are beamsplitters B which apply SU (2) transformations to logical 
kets {|0), |1)} as Figure |5|. i, and Kerr-type devices K which induce nonlinear interactions 
between two incoming photons as Figure [5| ii. The device K shifts a phase of a wave 
function by tt only if a pair of photons comes into it. (Q. A. Turchette et al. succeeds in 
shifting the phase by A ~ 16°||12||.) 

To clarify the operation of Figure |5]. iii, we describe it by a network of quantum gates 
in Figure [£|||13||. Assuming the first and the second qubits are in an arbitrary entangled 
state \^)q, we examine whether the first qubit exists or not by measuring an auxiliary 
qubit system A. When we write the whole system as 

I*>q|o>*= E cylOalihlO)* 

ij'6{0,l} 

|^)q|0)a is transformed as follows in Figure ||, 

\*)q\o)a = E( c ;oK>2|o>i + c, 1 |i) 2 |i> 1 )|o) A 

i 

^ EM*> 2 |1>i|0)a + caii) 2 i0)i|l)^) 
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Figure 5: The photon counting measurement with nonlinear optical devices, 
(i) 



50-50 beamsplitter 

input output 
mode b\^ b S mode a 



mode a 



mode b 



B : ll> a IO> b ^ -L(ll> a l0> b -I0> a ll> b ) 
I0> a ll> b ^ ^(|l> a |0> b +IO> a ll> b ) 



(ii) 



Kerr-type quantum phase-gate 



input 
mode x 
mode a 











K 





output 
mode x 
mode a 



K: ll> x IO> a H> x IO> a 



| 0>x ll> a I0> x ll> a 



(iii) 



Alice 



Eve 




Bob 





x"- 








Figure 6: A quantum network for photon counting 
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auxiliary ,q 
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Figure 7: Eve's Intercept/Resend attack on the system S. 

t=0 t=T 



Alice 



IV>Q ♦ — ^ 



la>s 




-iS-a-iv 



VL 1 ,L 2 € {/,H,a x ,Ho x }, Vae{0, 1] 



^ E(^oN) 2 |o)i + Qib') 2 |i>i)|i>A 

i 

= I*>q|1>a- 

Therefore, measuring an auxiliary system as shown in Figures [| and [] for each channel, 
Bob can examine whether all of the qubits are arrived or not. 



4 Security against eavesdropping 

It is difficult to consider all strategies Eve may take. In this section, we assume Eve 
to make only the Intercept/Resend attack. Eve measures each transmitted qubit with a 
proper basis independently and sends an alternative one according to the result of the 
measurement . We pay attention to the following fact. Eve cannot extract information 
about \^)q at all without getting the first password * of £/^|\I/)q, because the enciphered 
density operator is in proportion to I for her. Therefore, Eve needs to keep her illegal 
action secret from Alice and Bob during their authentication process so that Alice may 
disclose the first password *. In this section, we estimate a probability that Alice and Bob 
fail to notice Eve's illegal act. 

For simplicity, we assume that \^)q is an arbitrary n-qubit product state for a while. 
At the first encryption, Alice applies = o ix © • • • © a in to \^)q = <8> • • • <8> l^n)- 
Hence, Uf \$)q is also a product state and we may treat each qubit independently. 

We write the fcth qubit (VA; G {1, • ■ ■ ,n}) of U?\V) Q as |^)q = a\0) Q + f3\l) Q and 
the fcth qubit of the signature as \a)s (a G {0, 1}). A state that Alice sends at t = in 
Figure is given by 

aL 1 |0) Q L 2 |a) 5 + PL x \\) Q L 2 \a © l) s . 

Bob measures only the system S at t — r. If he gets \a)s, Alice and Bob consider the state 
is transmitted correctly. Bob uses the following projection operator for the measurement, 

n?f L2 = (L 1 |0)(0|L t 1 ) Q ® {L 2 \a){a\L\) s + {Lx\l)(l\L\) Q ® (L 2 \a © l)(a © 1|4) 5 . 
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Figure 8: Eve's Intercept /Resend attack on one qubit. 



I0> E 



■e- 



l<f» s =L 2 IO> s 
L 2 e {/, H, c x , Ha x 



Here, we assume Eve makes an attack only on the qubit of the system S as Figure [F] 
(U and V are arbitrary unitary transformations applied to one qubit). We write the 
dynamical process of S as a completely positive linear map $ that represents Eve's Inter- 
cept /Resend attack on S'fQ. Hence, the density operator p s at t = evolves to $(p s ) at 
t = t. We can write the state of QS at t = r as 

pZl 2 ^) = \a\\L 1 \U)^\L\) Q ®%{L 2 \a)(a\L\) s 

+aP*(L 1 \0)(l\L\) Q © $(L 2 \a)(a © l|4) s 
+/5a*(L 1 |l)(0|L t 1 ) Q ® $(L 2 |a © l><a|4)s 
+ |/3| 2 (L 1 |l)(l|L t 1 ) © $(L 2 |a © l)(a © 1|L 2 ) 5 . 

We can write the probability P that Bob obtains \a)s as 

= \a\ 2 (a\Ll$(L 2 \a)(a\Ll)L 2 \a) + \(3\ 2 (a © l|4$(L 2 |a © l)(a © l\L ] 2 )L 2 \a © 1). (5) 

Seeing this, we find the following fact. Although the initial state \iP)q of the system Q 
is a superposition of |0) and |1), we may regard the state as a mixed state of \4>)q = |0) 
and \iP)q = |1) with classical probability for evaluating P. 

Therefore, the probability of Bob's authentication is equal to an average of proba- 
bilities that a network of quantum gates in Figure |^ gives \<p)g as an outcome from an 
incoming state \4>)s — L 2 \0)s for all of L 2 e C Here, we evaluate P as follows. U and V 
are arbitrary unitary transformations applied to one qubit. We assume U is defined as 

U\<p ) = |0>, Ufa) = 

where {|y?o), is a certain orthonormal basis of Ti 2 . Then, we write |0) = co|<po) + 
Ci|«y9i). The state is transformed on the network of Figure ^| as 

\<P)s\0)e = (c fa)s + ci|^i) s )|0)b 

(£k)|0)s + d|l) S )|0)i5 

^ co|0) 5 |0) s + Cl |l) 5 |l) s 

co^|0)5|0) E + Cl F|l) 5 |l) E . (6) 

Seeing Eq. we find that Eve measures the enciphered qubit in the basis {|y?o), |<Pi)} 
and sends a ket vector of a basis {V|0),V|1)} according to a result of measurement. 
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Hence, we can write the probability P^ that Bob gets the correct signature for \<j>)s hi 
spite of Eve's illegal act as 

p = ic o ri(0iF|o)i 2 +| Cl | 2 K0|y|i)i 2 . (?) 

From now on, for simplicity, we write equations with density operators. Defining 
p = |^o)^o|, Pi = M(<Pi\, ~p' = V\0)(0\V\ & = V\1)(1\V*, 



(Trp p o )Po + ( Tr P4>Pl)p'i, 



we can write Eq. (ffi) as 



and Eq. ([/]) as 



p* = Tt [Hp<p)p<p\- 

Four density operators L 2 |0)(0|L2 {Li E C), emitted as \(f))s with equal probability, 



are described as 



Pl = \{ I + °z)i P~ = ^( J -0, p^ = ^{I + a x ), Rp =^(I -a x ). 
Then we define 

Pi = \[I+ i-iyx-tr], ff^^I + i-iyX'.tr] for i,jG {0,1}, 

where X = (X, Y, Z) and X = (X', Y', Z') are arbitrary three-component real vectors 
with \X\ 2 = \X'\ 2 = 1. Using the following formula, 

Tr(J + A ■ + B ■ &) = 2(1 + A ■ B), 

and averaging four kinds of P^, we estimate Pb that Bob measures the correct signature 
in spite of Eve's illegal act at 

Pb = \(P t + P^ + P^ + P?) = \(2 + XX + ZZ>) (8) 

Therefore, the probability that Alice and Bob do not notice Eve make an attack by 
the network of Figure |8] is 3/4 or less. If Eve makes the Intercept/Resend attack on the 
system Q, we can give a similar discussion. Consequently, the probability that Alice and 
Bob do not notice Eve's attacks on m qubits (either Q or S in each pair) is (3/4) m at 
most. 

Next, we consider the case that Eve makes the Intercept/Resend attack on both qubits 
of a pair QS independently in Figure (Ui, U 2 , Vj, and V 2 are arbitrary unitary transfor- 
mations). Measuring p® s transmitted from Alice, Eve sends the following density operator 
p® s ' to Bob, 

ij6{0,l} 
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Figure 9: Eve's Intercept/Resend attack on the system Q and S. 
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where 

pq, = uiwwi = (l/w+i-iyxi'"], 

fa = ul\ 3 ){j\u 2 = (i/2){i + (-iyx 2 .*i 

p' Q ,i = VMftV} = (l/2)[I+{-iyx s -tr], {) 
P'sj = V 2 \j)(j\V} = (l/2)[I+(-iyX 4 .a], 

and |X fc | 2 = l (k = l,---,4). 

Here, we can assume \a)s to be |0)s without losing generality. We write a transmitted 
state of Q as \4>)q = a\0) + Because Alice has sixteen kinds of ways to send the 

state for L 1; L 2 G C, Bob's final probability for authentication is described as 

Pb = ^ E Tr[$(p^ i2 )n^ i2 ]. (10) 

Writing the density operator of the state aLi\0) qL 2 \0) s + P Lx\l) qL 2 \1) s that Alice sends 
to Bob as p9 ^ , we can describe its explicit form as 

pf xM = |a| 2 (L 1 |0)(0|L t 1 ) Q ®(L 2 |0)(0|4) 5 

+a/3*(X 1 |0>(l|4)o®(X 2 |0)(l|4)s + ^a*(Li|l)<0|4) o <8)(L 2 |l)<0|4)s 
+ |/3| 2 (L 1 |l)(l|Ll) Q ®(L 2 |l)(l|4) 5 . (11) 

The projection operator for Bob is given by 

n^ L2 = (Li|0)(0|4)g ® (L 2 |0)(0|4)s + (Li|l)(l|Lj) g ® (L 2 |1)(1|L 2 ) 5 . 

Eq. ( [T0|) is linear for Pi^ l 2 - Therefore, we can divide Eq. (|ll|) into terms for calculation. 
First, we think about the first and forth terms of Eq. (|TTp. We write the first term as 

Q Q l!m = (^i|0)(0|L t 1 ) Q ® (L 2 |0)(0|4)5- (12) 

For example, if L\ = L 2 = I, we obtain 

gfj = (l/4)(I + a z ) Q ®(I + a z ) s , 

n?f = (1/4)[(I + ct z )q®(I + ct z )s + (I-<Jz)q®(I-ctz)s}, 
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and 

Tr[$(^j)ng] = (1/2)(1 + Z 1 Z 2 Z 3 Z A ). 
From similar calculations, we get 



it[$(& a )n?^ a 



Therefore, we obtain 



f {1/2){1 + Z 1 Z 2 Z 3 Z i ) for L 1; L 2 G {I,a x }, 

(1/2)(1 + X!X 2 X 3 X 4 ) for L u L 2 e {H, Ha x }, 

(1/2)(1 + for Li G {J, a,}, L 2 G {tf.ffa-*}, 

I (1/2)(1 + X 1 Z 2 X 3 Z 4 ) for L x G L 2 G 



^ £ Tr^^jngj = \ + ^(XxXa + ^Z 3 )(X 2 X 4 + Z 2 Z 4 ). 

Next, we think about the second and third terms of Eq. ([□]). We write the second 
term as 

Af& 2 = (£i|0>(1|4)q ® (L 2 |0)(l|4)5. 
For example, if L\ = L 2 = I, we obtain 

= (V 4 )(°"z + ® fax + &Cj/)s, 

Tr[$(A^f)ng] = (i/2)(x 1 + tY 1 )(x 2 + iY 2 )z 3 z 4 . 

From similar calculations, we get 
Tr[$(A^ 5 L2 )ng i2 ] 





e = 1 


e = -1 


' (1/2)[X X + ieY 1 ][X 2 + ieY 2 ]Z 3 Z i 


(L U L 2 ) = (/,/), 


(c^, 0";,;), 


-(l/2)[Xa + ieYiHXa - z'eF 2 ]Z 3 Z 4 




fa, I), 


(l/^f^-ienl^-ie^XaX, 


(#,#), 


(Ha x , Ha x ) 


-(1/2)[Z! - ien]^ + zeF 2 ]X 3 X 4 




(Ha x ,H), 


(l^fXi+^f^-^ZgX, 




(a x , Ha x ), 


-(1/2) [Xi + zeYi][Z 2 + *eF 2 ]Z 3 X 4 






(l/2)[^i-zeyi][X 2 + zey 2 ]X 3 Z 4 




(Ha x , a x ), 


t -(1/2)[Z! - ieY 1 ][X 2 - ieY 2 }X 3 Z, 




(Ha x ,I). 



Consequently, we obtain 

1 £ Tr[$(A^ L2 )n« 5 L J = —Y^Z, - X 3 )(Z 4 - X 4 ). 

Finally, obtaining 

P B = ~ + l(X 1 X 3 + Z 1 Z 3 )(X 2 X 4 + Z 2 Z 4 ) - ~(a/F + a*/5)F 1 F 2 (Z 3 - X 3 )(Z 4 - X 4 ), (13) 

Z o o 

we can show Pb < 3/4. (See Appendix A.) Therefore, if |\&}q is an n-qubit product state 
and if Eve makes the Intercept/Resend attack on both qubits of a pair QS independently 
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as Figure [|, the probability that Eve's illegal acts cannot be found is equal to 3/4 or less 
per one qubit. 

Especially, if the transmitted information is classical, \^)q is a product state of |0) 
and All of the 2n qubits transmitted are in states chosen from four ket vectors of two 
conjugate bases at random. If we regard a as a key of an n-bit random string and \^)q 
as an n-bit enciphered classical message, our method is equivalent to the one-time pad 
method with BB84. Assuming Eve makes attacks on m pairs of qubits in QS, we can 
estimate the probability of Eve's success in eavesdropping at (3/4) m or less. 

Then, we consider the case that \^)q is an arbitrary entangled state of n qubits. The 
enciphered state of \^)q with uf is also entangled and it is given by Eq. (||). 

First, we consider that Eve makes the Intercept/Resend attack on either one in a pair 
of qubits of the system Q and S as Figure |7|. If Eve makes this attack on m pairs out 
of n pairs of the system QS, we can regard the transmission as sending an ensemble of 
product states, where each qubit is |0) or |1), with classical probabilities, like Eq. (|5]). 
We can think in a similar way before and conclude that the probability Eve's illegal act 
cannot be found is (3/4) m or less. 

Next, we consider the case that Eve makes the attack on both qubits of a pair on the 
entangled system QS as Figure |^. If Eve makes this attack on m pairs out of n pairs, we 
can write the probability Eve is not found as an equation which is similar to Eq. ( |i~3"| ) and 
it is estimated at (3/4) m or less. (See Appendix B.) 

5 Privacy amplification process 

From previous discussion, we obtain the following results. If an arbitrary quantum state 
is enciphered by our method, a probability that Alice and Bob do not notice Eve is at 
most 3/4 per one qubit. (Both product and entangled states are available. We assume 
that Eve always makes eavesdropping with the Intercept/Resend attack.) Hence, if Eve 
makes attacks on m enciphered pairs, her success probability is given by (3/4) m and it 
decreases exponentially against m. 

However, there is a problem. In our method, if Eve replaces a pair of enciphered 
qubits with a pair of random ones, Alice and Bob do not notice her illegal act with 
probability of 1/2. In this case, they disclose passwords and Eve obtains one qubit of 
original information with fidelity 1. It is important that Eve gets a correct qubit and she 
knows that she obtains the correct one. 

Such a problem can be also occurred in the BB84. It is possible that Alice and Bob 
share the same random binary string and Eve knows a few bits of it exactly. To overcome 
this trouble, for example, Alice and Bob can choose some bits at random from the shared 
binary string and make a new bit from a summation of them with modulo 20. If they 
repeat this process and create a new binary string that is shorter than original one, Eve's 
expected information decreases to in some asymptotic limit. Such a technique is called 
privacy amplification. 

On the other hand, in our protocol, Eve's success probability for eavesdropping on 
one-qubit cannot always reach 0. To decrease it to asymptotically, Alice and Bob apply 
our protocol over and over again. To make discussion simple, we consider encryption of 
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one-qubit quantum information for a while. 

Preparing an arbitrary one-qubit state \ipi) and a one-qubit signature \ai) (Vax <G 
{0, 1}), Alice applies our protocol to l^i^ai) and generates an entangled two-qubit state 
\ip2). Then, she prepares other qubits |a 2 )|o3) for a signature, and enciphers IV^)!^)!^) 
again. She obtains a four-qubit state ^3). 

If Eve wants to get quantum information of with fidelity 1, she has to interact 
with all four qubits of \iffs). F° r example, if Eve replaces ^3) with random four qubits, 
Alice and Bob notice her illegal act with probability of (1/2) 3 = 1/8, because they carry 
out the authentication process with \ai), |a 2 ), and |a 3 ). 

If Alice enciphers for n times, the nth encryption needs 2 n_1 signature qubits. If 
Eve makes attacks on all enciphered qubits of \ip n+ i), the probability that Alice and Bob 
do not notice her act is (3/4) Ar,/2 at most, where N = 2 n is the number of all enciphered 
qubits. (The probability 3/4 comes from the fact that Alice enciphers the state with 
rectilinear and circular bases at random, and it does not depend on \ip n ).) Hence, Eve's 
success probability that she gets |-?/>i) with fidelity of 1 decreases exponentially against 
the number of qubits, and reaches in the limit of N — > 00. 

Another method is as follows. Alice and Bob share a random binary string beforehand 
as the first password (subscripts of Pauli matrices) in secrecy by BB84. Because they do 
not need to disclose it, Eve can never get information of at all even in the case that 
they do not notice Eve's disturbance. In this method, the privacy amplification has to be 
done for BB84 actually. 

6 Discussion 

To understand our method more clearly, we consider a simple one and compare it with 
ours. For transmitting an n-qubit quantum state in secrecy, we can take the following 
method. Enciphering an n-qubit state p n as Eq. (Q), Alice prepares other n qubits as 
check ones that are given as {|0), |1)} or {(l/y / 2)(|0) ± |1))} at random respectively. 
Then, Alice permutes all of the 2n qubits at random and sends them to Bob. 

Here, we assume Eve tries to eavesdrop on only one qubit of p n . Because Eve does not 
know which qubits are check ones, a probability that Alice and Bob fail to notice Eve's 
illegal act can be (1/2)[1 + (3/4)] = 7/8 as the maximum, in spite of 3/4 for our method. 
This is because we use entanglement in our method. 

Even if Eve prepares an arbitrary one-qubit state by herself in spite of taking away 
a qubit from p n , its expectation value of fidelity is equal to 1/2. This shows that Eve's 
success probability of eavesdropping is always equal to 1/2 or more. In our method, if 
Eve interacts enciphered qubits, a probability of her success is equal to at most 3/4 per 
one qubit (without privacy amplification). It is similar to the BB84. 

In this paper, the security against Eve's attack with using entanglement is not con- 
sidered (for example, a case that she uses a quantum computer for eavesdropping as 
Figure |10D . In Figure [U], it is difficult to evaluate the upper bound of the probability 
that Bob measures the signature correctly for arbitrary unitary transformations Ui, U2, 
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Figure 10: Eve's attack on the system QS by using entanglement. 
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Vi, and V%. For instance, assuming 



u 1 = u 2 = v 1 = v 2 = u 



where U 



cos(7r/8) 
sin(7r/8) 



sin(7r/8) 

- COs(7t/<! 



and \^)q represents classical information (an n-qubit product state of |0) and |1)), we 
get P B = (13/16) > (3/4) for Figure i and P B = (H/16) < (3/4) for Figure [TO], ii. 
Eavesdropping with U is equivalent to measuring and resending a qubit in the following 
basis, 

I^X^I = 1(1 + (-1)' ; X -a), X = (i=, 0, -L), 



which is called the Breidbart basis 0]. About Figure [10|. i, P B may exceed 3/4. But, the 
amount of information Eve can extract in Figure [l(| i seems to be less than the amount 
of information she obtains by the Intercept/Resend attack on one qubit as Figure [7| 

In our method, if Eve takes away qubits, Alice and Bob lose original information of 
them. 

We mentioned in Sec. that the classical key distribution can be done only by the 
uncertainty, and the entanglement is not essential for it0]l|]. On the other hand, for 
transmitting quantum states by the quantum teleportation, the entanglement plays an 
essential role||. Our method uses both two properties. 

Recently, the method for transmitting classical binary data (not a classical random 
string) in secrecy with a pair of entangled photons has been proposed||15|]. It is charac- 



terized by the following facts. First, Alice and Bob prepare two conjugate bases on Ti^ 
each for encoding message and measuring photons. Second, they use a two-dimensional 
subspace of for encoding a binary digit. 
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A The maximum value of Pb for a product state |^)g 

Here, we show that Pb defined in Eq. (|13"D never exceeds 3/4. 

Because of \a\ 2 + \[3\ 2 = 1, we get —1 < a(3* + a*(3 < 1. Hence, altering the signs of 
Xi as Xi — > —Xi (i — 1, ■ ■ ■ , 4), we can write the upper bound of Pb as 

„ . 1 1 , 

Pb < - + -J max, 

where Jmax is the maximum value of 

/ = (XxX 3 + Z 1 Z 3 )(X 2 X 4 + Z 2 Z 4 ) + Y 1 Y 2 (X 3 + Z 3 )(X 4 + Z 4 ), (14) 

with \Xi\ 2 = 1 and X h Y h Z { > for % = 1, • • • , 4. 

Seeing Eq. (|I4]), we give another form of / as follows, 

f=\A-B\, 

where 

A = (X 1 X 3 + Z 1 Z 3 ,Y 1 (X 3 + Z 3 )), 
B = (X 2 X 4 + Z 2 Z 4 ,Y 2 (X 4 + Z 4 )). 

(We pay an attention that A and B are two-component real vectors.) From the Cauchy- 
Schwarz inequality, we get 

f<\A\\B\. 

Therefore, by estimating the maximum values of \A\ and \B\, we derive the upper bound 
of/- 

We can write \A\ 2 in the following form, 

\A\ 2 = (1 - Z\)Xl + (1 - X 2 )Z 2 + 2(X 1 Z 3 )(Z 1 X 3 ) + 2Y 2 (X 3 Z 3 ). 
On the other hand, from the arithmetic-geometric inequality, we obtain 

(X 1 Z 3 )(Z l X 3 ) < i[(X 1 Z 3 ) 2 + (Z 1 X 3 ) 2 ], 
X 3 Z 3 < \{xl + zj). 

Therefore, we get 

\A\ 2 < (1 + Y 2 )(Xl + Z 2 ) < 1 + Y 2 < 2. (15) 

We obtain |A| < y/2. In a similar way, we obtain \B\ < \[2. From these results, we can 
conclude that / < 2 and Jmax — 2. 
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B The maximum value of Pg for an entangled state 

l*>« 

We estimate the probability that Eve's illegal act cannot be found in the case where she 
makes the Intercept/Resend attack on m pairs of qubits on the system QS for an arbitrary 
entangled \^)q of n qubits. 

For simplicity, we assume \^)q to be an arbitrary entangled state of two-qubit system 
qq' at first, 

»,ie{o,i} 

Alice puts two qubits of the system S(= ss') for the signature on the qubits of the system 
Q{= qq') respectively. Then, she makes entanglement between the systems Q and S with 
C-NOT gates, applies L\, L 2 , L[, L' 2 G £ to four qubits q, s, q', s' respectively, and sends 
them to Bob (see Figure |7|). Eve makes the Intercept/Resend attacks on the systems q, 
s, q', s' respectively as shown in Figure We can assume the initial states of qubits s, s' 
that represents the signature to be |0) s |0) s ' without losing generality. 
Writing the state sent by Alice as 

53 CijL^i) q L 2 \i) s <8> L[\j) q ,L 2 \j) s ,, 
i,je{o,i} 

we can describe the density operator explicitly as 

pI'l^li = (L 1 L 2 L' 1 L' 2 ) Yl [|c«| 2 (|i><*lff® l*)(*l-)®(b')0V® 

i,ie{0,i} 

+Cij<%(\i)(i\ q ®\i)(i\.) ® (\j)(j\ q > ® \j)(j\s') 

® ® (b')OV ® b')0V) 

<g> |z)(i| s ) (g) (|j)(j| ? , <g> |j){^|y)](L 1 L 2 L , 1 4)t, (16) 

where i = i + 1 (mod 2). 

Eavesdropping on the state P^^l' L / , Eve transforms it to the following state, 

OS s _ V" Tv/QS 



where 



ij,fe,2e{0,l} 



(l/2)[/+(-iyX 2 .a], 

(l/2)[I+(-l)'X 4 -*], 
(l/2)[I+(-l)'X' 2 .<r], 

(l/2)[f+(-W-<r], 



n?f i2L ^ = (L 1 L 2 )(|0)(0| 9 ®|0)(0| s + |l)(l|,®|l)(l| s )(L 1 L 2 )t 

®(Li4)(|0)(0|,i (8) |0)(0| s , + <g> 1 1) (11,0(44)+. 





= (l/2)[I+(-l)*X a 




P«j = 


Pq,i 


= (1/2) [I +(-l)'X 3 




P'sj = 


Pq',k 


= (i/2)[/ + (-i) fc x; 


■cr], 


Pa', I = 


Pq',k 


= (l/2)[I+(-l)*X' s 


■cr], 


P's',1 = 


and Xfc 2 


= |X' fe | 2 = l (* = !,.•■, 


4). Bob 


measures 



(17) 
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The probability that Bob measures the correct signature is given by 

Pb = (b 2 E E Tr[$( P ?f L2L , L ,)n?f L2L , L ,] 

1U L u L 2 eC L[,L' 2 eC 

= [\ + ^(X,X 3 + Z 1 Z 3 )(X 2 X 4 + Z 2 Z A )][^ + l -{x[x' z + Z[Z' 3 )(X' 2 X' 4 + Z' 2 Z't)\ 

+ E {c lJ c* ] il + hx 1 x 3 + z 1 z 3 )(x 2 x 4 + z 2 z i )] 

ij6{0,l} 

x[-^r 2 '(^-^)^-^)] 
+^4h^™( z 3 - a 3 )(z 4 - x 4 )][i + l -{x[x', + ziztiwxi + z^zi)] 
+^4[-^ 1 y 2 (z 3 - x 3 )(z 4 - XOH-^'^ - X' 3 )(Z' 4 - X' 4 )}}. 

From Ejj £ {o,i} M 2 = 1, we obtain | Ejj e {o,i} c i? c *jl < 1, I £ije{o,i} c ^ c fjl ^ and 

| Ejje{o,i} c ii c fjl < 1- Therefore, using the result obtained in Appendix A, we can conclude 

Pb<(\ + ^ max) 2 = (I) 2 - 

(We pay attention to a fact that each term of Pb can be gathered with a binomial 
coefficient.) When Eve attacks on m pairs out of enciphered qubits generated from an 
arbitrary n-qubit entangled state \^)q, we obtain Pb < (3/4) m . 
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